SSL decryption issue on Palo Alto firewall

[karansin_amd]

We have SSL decryption running on our PAN for selective URL categories however we noticed that at times PAN logs decrypt action for categories not included in decrypt rule. Any idea why this may be happening ? This is not always but we see many traffic/URL filtering logs that has proxy flag set to "yes" for categories we do not decrypt per decrypt rule.

[Raido_Rattameister]

Some URLs are in multiple categories.

For example dns.google is in in Computer-and-Internet-Info and Encrypted-DNS categories.

Check "URL Category List" value for the URL.

[karansin_amd]

I did check and the URL is part of categories which are not part of decrypt rule. I suspect it is issue with proxy engine on PAN platform